Bad connection reuse due to flawed path name checks

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup. Due to errors in the logic, the config matching function did not take 'issuer cert' into account and it compared the involved paths case insensitively, which could...

SP Project & Document Manager < 4.22 - Authenticated Shell Upload

The plugin allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for...

Mozilla Rust 跨站脚本漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A cross-site scripting vulnerability exists in Rust in versions prior to comrak crate 0.9.1, which stems from the fact that the protection mechanism for data: and javascript: URIs is case-sensitive. No details o...

DEBIAN-CVE-2020-28948

ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

CVE-2020-15234 Redirect URL matching ignores character casing

ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite before version 0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using strings.ToLower while they should have been compared wi...

PT-2020-6439

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.0.0 through 6.0.9 FortiOS versions 6.2.0 through 6.2.3 FortiOS version 6.4.0 Description An improper authentication issue exists in the SSL VPN functionality of FortiOS. This allows attackers to bypass two-factor...

KB4535706 - Description of the security update for SQL Server 2016 SP2 CU11: February 11, 2020

KB4535706 - Description of the security update for SQL Server 2016 SP2 CU11: February 11, 2020 Summary A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services if it incorrectly handles page requests. An attacker who successfully exploits this vulnerability could...

Server-Side Template Injection

pebble is vulnerable to server-side template injection. The allowGetClass validation can be bypassed due to lack case-sensitivity verification. An attacker is able to inject arbitrary code through the template using object.CLASS , object.Class or object.getclass...

Design/Logic Flaw

verifycertificateidentity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to 1 multiple wildcards, 1 wildcards in IDNA names, 3 case...

CVE-2015-1855

verifycertificateidentity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to 1 multiple wildcards, 1 wildcards in IDNA names, 3 case...

[SECURITY] [DSA 4321-2] graphicsmagick update

------------------------------------------------------------------------- Debian Security Advisory DSA-4321-2 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 28, 2018 https://www.debian.org/security/faq -...

Improper Handling of Case Sensitivity

Improper Handling of Case Sensitivity in easyadmin-extension-bundle...

Improper Handling of Case Sensitivity

Improper Handling of Case Sensitivity in easyadmin-extension-bundle...

CVE-2018-8337

A security feature bypass vulnerability exists when Windows Subsystem for Linux improperly handles case sensitivity, aka "Windows Subsystem for Linux Security Feature Bypass Vulnerability." This affects Windows 10, Windows 10 Servers...

CVE-2018-8337

A security feature bypass vulnerability exists when Windows Subsystem for Linux improperly handles case sensitivity, aka "Windows Subsystem for Linux Security Feature Bypass Vulnerability." This affects Windows 10, Windows 10 Servers...

Security feature bypass

A security feature bypass vulnerability exists when Windows Subsystem for Linux improperly handles case sensitivity, aka "Windows Subsystem for Linux Security Feature Bypass Vulnerability." This affects Windows 10, Windows 10 Servers...

CVE-2018-8337

CVE-2018-8337 is a local security feature bypass in Windows Subsystem for Linux (WSL) where WSL improperly handles case sensitivity. A low-privilege local attacker could replace or delete arbitrary files by running a crafted application. Affected: Windows 10 and Windows Server 2016/1709/1803 rang...

CVE-2018-8337

A security feature bypass vulnerability exists when Windows Subsystem for Linux improperly handles case sensitivity, aka "Windows Subsystem for Linux Security Feature Bypass Vulnerability." This affects Windows 10, Windows 10 Servers...

Microsoft Windows Subsystem for Linux Security Bypass Vulnerability

Microsoft Windows 10 and Windows Server Version 1803 are both operating systems released by Microsoft Corporation in the U.S. Microsoft Windows 10 is an operating system for personal computers.Windows Server Version 1709 is a server operating system.Windows Subsystem for Linux is one of the Linux...

Windows Subsystem for Linux Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists when Windows Subsystem for Linux improperly handles case sensitivity. An attacker who successfully exploited this vulnerability could replace or delete arbitrary files as a low privilege user. A attacker could exploit this vulnerability by running a...